Configuring System Logging in Gaia Portal

This section includes procedures for configuring System Logging and Remote System Logging.

System Logging configures if GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. sends these logs:

Remote System Logging configures a remote syslog server, to which Gaia sends its syslog messages.

Note - There are settings that you can configure only in Gaia ClishClosed The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)..

Important:

  • Do not configure two Gaia servers to send system logs to each other - directly, or indirectly.

    Such configuration creates a syslog forwarding loop, which causes all syslog messages to repeat indefinitely on both Gaia servers.

  • On Scalable Platforms (Maestro and Chassis), you must connect to the Gaia PortalClosed Web interface for the Check Point Gaia operating system. of the applicable Security Group.

Step

Instructions

1

In the navigation tree, click System Management > System Logging.

2

In the System Logging section, select the applicable options:

 

  • Send Syslog messages to management server

    Specifies if the Gaia sends the Gaia system logs to a Check Point Management Server.

    Default: Not selected

    Note - You can configure this option in Gaia Clish with the "set syslog cplogs {on | off}" command.

 

  • Send audit logs to management server upon successful configuration

    Specifies if the Gaia sends the Gaia audit logs (for configuration changes that authorized users make) to a Check Point Management Server.

    Default: Selected

    Note - You can configure this option in the Gaia Clish with the "set syslog mgmtauditlogs {on | off}" command.

 

  • Send audit logs to syslog upon successful configuration

    Specifies if the Gaia saves the logs for configuration changes that authorized users make.

    Otherwise, Gaia uses the default /var/log/messages file.

    Default: Selected

    To specify a Gaia configuration audit log file, run this command:

    set syslog filename /<Path>/<File>

    Note - This option is configured in the Gaia Clish with the "set syslog auditlog {disable | permanent}" command.

3

Click Apply.

Step

Instructions

1

In the navigation tree, click System Management > System Logging.

2

In the Remote System Logging section, click Add.

3

In the IP Address field, enter the IPv4 address of the remote syslog server.

4

In the Priority field, select the severity level of the logs that are sent to the remote server.

These are the accepted values (as defined by the RFC 5424 - Section-6.2.1):

  • All - All messages

  • Debug - Debug-level messages

  • Info - Informational messages

  • Notice - Normal but significant condition

  • Warning - Warning conditions

  • Error - Error conditions

  • Critical - Critical conditions

  • Alert - Action must be taken immediately

  • Emergency - System is unusable

5

In the Port field, enter the applicable port number on the remote syslog server.

Range: 1-65535

Default: 514

6

In the Protocol field, select the applicable protocol - UDP or TCP.

Default: UDP

7

Click OK.

Step

Instructions

1

In the navigation tree, click System Management > System Logging.

2

In the Remote System Logging section, select the remote server.

3

Click Edit.

4

Configure the required settings.

5

Click OK.

Step

Instructions

1

In the navigation tree, click System Management > System Logging.

2

In the Remote System Logging section, select the remote syslog server.

3

Click Delete.

4

In the confirmation window, click Yes.

By default, Gaia Operating System saves the Syslog configuration in these files:

  • /etc/rsyslog.conf

  • /etc/sysconfig/rsyslog

If it is necessary to add specific settings manually in these files (that Gaia OS does not have), then it is necessary to make these files immutable, so Gaia OS does not overwrite them:

  1. Connect to the command line on Gaia OS.

  2. Log in to the Expert mode.

  3. Edit the applicable Syslog configuration file as required in your environment.

  4. Examine the current attributes on the applicable configuration file you edited:

    • lsattr /etc/rsyslog.conf

    • lsattr /etc/sysconfig/rsyslog

  5. Add the immutable attribute on the applicable configuration file you edited:

    • chattr +i /etc/rsyslog.conf

    • chattr +i /etc/sysconfig/rsyslog

  6. Examine the current attributes on the applicable configuration file you edited:

    • lsattr /etc/rsyslog.conf

    • lsattr /etc/sysconfig/rsyslog

  7. Restart the Syslog service:

    service rsyslog restart

Warning - While the Syslog configuration files are immutable:

  • Gaia OS cannot save the changes in the Syslog configuration you make in Gaia Portal or Gaia Clish.

  • Gaia OS cannot restore a Gaia Backup.

To remove the immutable attribute from a file, use this command:

chattr -i <file>